Image Inversion Exposure in Dark Reader Browser Extension

CVE-2026-92706

What is CVE-2026-92706?

An information disclosure vulnerability was identified in the Dark Reader browser extension prior to versions 4.9.126 and 4.9.128. This issue arises when a website triggers the extension’s image inversion pipeline, leading it to request an unauthenticated bitmap from a locally running web server. The mechanism leverages known public-like HTTPS URLs, inadvertently crossing the website-to-local-network boundary and potentially disclosing limited information about the requested resources. It is crucial to update to the latest versions to mitigate this risk.

References